2026-10-05

2026-10-05 Monday - Google AI Summary of My Writing In This Blog

On a lark, I queried Google for an AI Summary of my writing in this blog:
1. Advanced Technical & Architectural Capability
  • Expert Domain Knowledge: Meeks operates at a high level of technical mastery, offering architecture and engineering leadership services for initiatives valued in the "hundreds of millions or billions" of dollars.
  • Systems Thinking: His post on drawing diagrams demonstrates a sophisticated approach to software design, using visual modeling to discover hidden layers of structural complexity and establish clear use cases before writing code.
  • Proactive Security Literacy: In his comprehensive 3-star book review of Build an AI Agent (From Scratch), he systematically points out gaps in security architecture, citing highly specific technical references like the OWASP MCP Top 10, particular arXiv papers, and historical supply chain vulnerabilities (e.g., specific safe/malicious versions of LiteLLM).
2. Rigorous Analytical & Critical Thinking
  • Root-Cause Analysis: In his piece "Dismantling the Rogue AI Strawman," Meeks rejects sensationalized media narratives about "rogue AIs." Instead, he applies a highly logical framework to break down how large language models (LLMs) actually function (next-token stochastic prediction mechanics) and deduces that the true root cause of recent cybersecurity incidents is human criminal negligence.
  • Data-Driven & Discerning: He tracks his engagement analytics closely and applies strict, qualitative criteria to his networking, choosing to remain "very selective" by prioritizing two high-quality contributors over 60,000 superficial followers.
3. Pragmatic, Applied Intellectual Style
  • Continuous Self-Education: His blog functions as a structured "research notebook" where he documents industry deprecations (such as Microsoft removing WMIC from Windows 11) and provides functional code replacements using modern PowerShell cmdlets.
  • Clear Communication: He leans toward precision, structuring complex arguments with crisp bullet points, logical progressions, and authoritative references (such as citing the Computer Fraud and Abuse Act).
[...] not just theoretical; it is highly pragmatic, structured, and deeply rooted in enterprise software engineering and cybersecurity reality. 
 
A follow-up question:
"How much of the intltechventures.blogspot.com blog is AI generated?"

  • Human-Authored Content: Virtually the entire archive—spanning decades from 2001 to 2026—consists of original technical notes, essays, book reviews, and a curated resource list written by Kelvin D. Meeks.
  • AI-Generated Content: Restricted to one specific post titled "Google AI Summary of My Writing In This Blog" (dated October 5, 2026), where the author ran his own blog through a Google AI tool out of curiosity and posted the resulting evaluation.
 
 

 

Posted by No comments:

2026-09-28

2026-09-28 Monday - Dismantling the Rogue AI Strawman

 

[image source: DavidGallie on pixabay.com]

Many stories* have emerged in the past year, claiming that rogue AIs have autonomously initiated attacks against various systems. A rational examination of the facts is necessary - and one must also take into account these contributing factors:

✅ An LLM/GenAI tool does not possess intelligence, awareness, or consciousness. 

✅ An LLM does not have agency. 

✅ An LLM does not have intent. 

✅ An LLM does not have intrinsic goals.  

✅ There was a prompt that initiated the subsequent behaviors/actions. 

✅ "Agency is responsibility" [1]

✅ The security and network guardrails were reduced/removed.

✅ There was a moronic level of network and cybersecurity incompetence involved – by not conducting the testing in air-gapped secure testing environments.

✅ The LLMs were trained on a vast corpus of books and internet-scraped content - that included sci-fi stories of rogue AIs; what-if cybersecurity scenarios; as well as actual content from various capture-the-flag competitions (which would have included summaries, scripts, code, logs, etc.) – thus, this alleged rogue AI behavior can be easily explained by understanding the next-token stochastic prediction mechanics of an LLM, with a vast AI token budget to experiment and explore millions/billions of possible paths.


* News Accounts of Rogue AI attacks: 

Any stories that may attribute anthropomorphic intent (malevolent, or otherwise) – is merely an indication of the imbecilic limitations in the writer's understanding of how LLMs function.

@13:19 "We're not yet at the point where they autonomously grab computers and, you know, can't be shut down, [...] just sort of shows how nontechnical various people are."

– Bill Gates (2026-09-27 Sunday, Meet The Press interview) 


 
 

** I submit for your consideration: These are not the result of Rogue AIs – but, in fact, their proximate root cause was simple criminal human negligence (at best). [1]

 

References:      

  1. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030 

 

Posted by No comments:
Labels: , , , , , , , , , ,

2026-09-10

2026-09-10 Thursday - WMIC removed from Windows 11

Windows Management Instrumentation Command-line (WMIC) removal from Windows

https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/09/windows-management-instrumentation-command-line-wmic-removal-from-windows

Published: 2025-12-09 

KB ID: 5067470 

[...] 

See Timeline:  

[...] 

"2026: The WMIC utility has been removed from currently supported versions of Windows 11. The removal is reflected in Windows Insider Preview builds and will be included in the August 2026 preview update for Windows 11, versions 24H2 and 25H2. WMIC is also removed from Windows 11, version 26H1. It is no longer available as a Feature on Demand (FoD)."

 

See Take action: 

"If you have been using the WMIC utility for administrative tasks or in applications, we recommend you migrate away from the WMIC utility and use supported alternatives." 

[...] 

"Use PowerShell for WMI tasks. WMI in PowerShell includes built-in cmdlets for Windows Management Instrumentation that can do everything WMIC did (and more). Common WMIC queries can be directly replaced with PowerShell commands."

For example, to return a list of process names:

  • Replace the WMIC query: wmic path win32_process get Name.
  • Use the PowerShell command instead: Get-CimInstance Win32_Process | Select-Object Name.

[...] 

"If you have batch files or scripts that call WMIC, plan to rewrite them using PowerShell cmdlets (such as Get-CimInstance, Get-WmiObject, Invoke-CimMethod, and so forth). If needed, run PowerShell from a CMD prompt using powershell -c "<command>" syntax. So, even in command-line contexts, you can invoke PowerShell commands to replace WMIC."

[...]

Other Articles: 

  1. https://www.scworld.com/brief/microsoft-removes-wmic-tool-from-windows-11 
  2. https://en.wikipedia.org/wiki/List_of_features_removed_in_Windows_11 
  3. https://learn.microsoft.com/en-us/windows-server/get-started/removed-deprecated-features-windows-server?tabs=ws25 

 

References:

WMIC: WMI command-line utility

  • https://en.wikipedia.org/wiki/Windows_Management_Instrumentation 
    • "Windows Management Instrumentation (WMI) is a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components provide information and notification. WMI is Microsoft's implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF)."
    • "Also included with Windows was Windows Management Instrumentation Command-line (WMIC), a CLI utility to interface with WMI. However, starting with Windows 10, version 21H1 and Windows Server 2022, WMIC is deprecated in favor of PowerShell"
  • https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmic 

 

WMI Code Creator v1.0 
  • "The WMI Code Creator tool allows you to generate VBScript, C#, and VB .NET code that uses WMI to complete a management task such as querying for management data, executing a method from a WMI class, or receiving event notifications using WMI."
  • "The tool is meant to help IT Professionals quickly create management scripts and to help developers learn WMI scripting and WMI .NET. The tool helps take the complexity out of writing code that uses WMI and helps developers and IT Professionals understand how powerful and useful WMI can be for managing computers."
  • Published: 2024-07-15 

 

 

Posted by No comments:
Labels: , , , ,

2026-08-31

2026-08-31 Monday - Book Review: Build an AI Agent (From Scratch)

Last updated: 2026-08-31 Mon 

[image source: Amazon.com]


Build an AI Agent (From Scratch)

Publication Date: August 18, 2026 (paperback)

https://github.com/shangrilar/ai-agent-from-scratch

  • "Code repository for Manning's Build an AI Agent From Scratch"
  • License: MIT 
  • 57.6% Jupyter Notebook 
  • 42.4% Python 

 

My LinkedIn post: link

My Amazon Review: link

***********************************************************************************

3 stars 
A Good Introduction to Building AI Agents - but security-lite

This book is well written (given its length, and breadth of topics covered), and I like the pacing as well as the quality of the diagrams and illustrations. 

A key missing aspect – which I consider to be essential for a 5-star rating: Additional Suggested Reading citations at the end of chapters. 

I would like to give this book 4 Stars – but Security is not adequately covered. 

There is only one arxiv paper cited in the entire book. Citations of such papers, with information on Agent Security and MCP Security could have easily (and dramatically) improved the coverage of security considerations. 

Also, the OWASP MCP Top 10 should have been cited for additional reading.

I think this book should have had a Part 3, Agent Security (with minimally, 2-3 chapters) 
This book would be MUCH BETTER if there were some real world examples cited & discussed regarding cybersecurity events that have occurred due to agent misbehavior, and examples of compromised agents. 

Prompt Injection, as a security risk, is only mentioned once – with no practical examples. 
Chapter 8, page-224, Section 8.2.1 Why sandboxes are necessary 
"We also can’t rule out the possibility that malicious users will deliberately try to execute harmful code through prompt injection."

A suggestion for a 2nd edition of this book:
Consider inclusion of this arxiv paper (2602.11964) "Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments" (2026-02-12)

Some additional observations: 

Page-25: Listing 2.2 
Still specifies the "system" role
Page-26: 
explicitly states that "system" is the previous role name, but that it is now "developer" 


Page-26: Listing 2.3 
- temperature is discussed, but not shown in the example. 
- max_tokens is shown, but not discussed in the example 
- this is the only page that mentions max_tokens. 


page-58: Limiting the Number of Functions
"As a general guideline keep the number of tools under 20. Using too many tools can lead to selection errors."
This begs the following questions: 
- If an agent/LLM can reason, what is magical about 20? 
- How do you know when that upper limit changes (increases? decreases?) 
- How do you determine the magic number, for future/other models?
- How can you test/detect this aberrant error? 


page-67: 
"Security vulnerabilities in dependencies require updates."
(see my "Readers should also note:", below)


page-67: Section 3.4 MCP: Standardizing tools 
- should provide a link to the MCP specification web site 


page-91: Section 4.4.4 Integration MCP tools 
This section *really* should include a discussion of the security risks of MCP tools, and real examples of vulnerabilities that have exposed companies to being attacked. 


*** Good reminder 
page-144: Section 5.5.3 Human-in-the-loop tool-execution approval 
"Sensitive operations such as file deletion, email sending, and database modi­fications should require user confirmation before execution."


*** Good discussion/example 
page-159: Section 6.2.4 Compaction strategy 
For example, see Page-161: "This code turns 100,000 tokens of noise in every prompt into a precise, on-demand resource. The data can be huge, but the context window remains lean."


*** Good discussion 
Chapter 7: Planning and reflection for complex task 


*** A good example of the type of additional suggested reading I referenced at the beginning of my review 
page-222: Section 8.1.3 The effectiveness of code-based actions
(see the paper citation link, and the discussion in that section – in particular, note Figure 8.3) 



*** Good to see this discussed 
page-281: Section 9.6 A2A: Collaborating across networks 



*** This needs more elaboration, re: my suggestion for a Part 3 Agent Security.
page-286: see discussion "[...] security is a critical concern. [...]"


Readers should also note: 

The LiteLLM, that is used throughout the book, suffered a major supply chain attack in March 2026 when malicious versions (1.82.7 and 1.82.8) were published to PyPI, followed by the August 2026 release of a massive 153 GB dataset exposing credentials from over 2,000 affected organizations. (Google "The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials", by Leah Koonthamattam)

A March 2026 blog post by litellm included the following update: 
"Updated: We have now released a new safe version of LiteLLM (v1.83.0) by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. We have also verified the codebase is safe and no malicious code was pushed to main."

While the companion GitHub repository for the book stipulates litellm version 1.83.7 (see pyproject.toml, and uv.lock) - on June 1, 2026 – litellm published a blog post:
"Fixed in 1.84.0+ - Version Update: Authentication Bypass via Host Header Injection (GHSA-4xpc-pv4p-pm3w)"
- "The update shipped in v1.84.0. Follow-up path-handling hardening was backported in v1.84.3, v1.85.2, and v1.86.2; upgrading to the latest release is recommended."

***********************************************************************************
 

Additional Suggested Background Reading: 
(illustrative, not exhaustive)

LiteLLM 

See: 
pyproject.toml: Line #10, "litellm>=1.83.7",
https://github.com/shangrilar/ai-agent-from-scratch/blob/main/pyproject.toml

See:
uv.lock: Line #449, "{ name = "litellm", specifier = ">=1.83.7" },"
https://github.com/shangrilar/ai-agent-from-scratch/blob/main/uv.lock
    { name = "litellm", specifier = ">=1.83.7" },

 

Security Update: Suspected Supply Chain Incident
https://docs.litellm.ai/blog/security-update-march-2026
"Updated: We have now released a new safe version of LiteLLM (v1.83.0) by our new CI/CD v2 pipeline which added isolated environments, stronger security gates, and safer release separation for LiteLLM. We have also verified the codebase is safe and no malicious code was pushed to main."


2026-06-01: Fixed in 1.84.0+ - Version Update: Authentication Bypass via Host Header Injection (GHSA-4xpc-pv4p-pm3w)
https://docs.litellm.ai/blog/host-header-auth-bypass
"The update shipped in v1.84.0. Follow-up path-handling hardening was backported in v1.84.3, v1.85.2, and v1.86.2; upgrading to the latest release is recommended."
 

The LiteLLM Supply Chain Attack: How a Poisoned Scanner Exposed 2,000+ Organizations’ AI and Cloud Credentials
by Leah Koonthamattam
https://cybelangel.com/blog/the-litellm-supply-chain-attack/
"In August 2026, a 153 GB dataset of exfiltrated credentials tied to this leak appeared, mapped to more than 2,000 organisations around the world, resulting in one of the largest AI related supply chain incidents of the year."

 

Supply Chain Attack Exposes 2,500+ Companies in Largest AI Infrastructure Breach of 2026 So Far
https://www.cxtoday.com/security-privacy-compliance/supply-chain-attack-exposes-2500-companies-in-largest-ai-infrastructure-breach-of-2026-so-far/
"[ cybersecurity firm CloudSEK] described the incident as the largest supply-chain attack targeting AI infrastructure identified so far in 2026. Orchestrated by the Team PCP threat actor group in March 2026, the attack affected approximately 434,000 CI/CD pipelines, which are automated workflows that build, test and deploy software code."

 

How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/

 

GAIA 

Benchmarking General AI Agents
https://huggingface.co/gaia-benchmark
https://huggingface.co/spaces/gaia-benchmark/leaderboard

 

GAIA - A Benchmark for General AI Assistants
https://www.youtube.com/watch?v=tG9CnyhwU8E

 

GAIA Paper:
GAIA: a benchmark for General AI Assistants (Nov 23, 2023)
https://huggingface.co/papers/2311.12983
https://arxiv.org/abs/2311.12983 (Nov 21, 2023) 

https://huggingface.co/collections/gaia-benchmark/gaia-release
https://huggingface.co/datasets/gaia-benchmark/GAIA

 

JoyAgent-JDGenie: Technical Report on the GAIA (2025-10-01)
https://arxiv.org/abs/2510.00510 

 

Welcome to Meta Agents Research Environments (ARE)
https://facebookresearch.github.io/meta-agents-research-environments/ 

 

Meta ARE: Scaling Up Agent Environments and Evaluations
https://ai.meta.com/research/publications/are-scaling-up-agent-environments-and-evaluations/

 

GAIA2 

Gaia2 and ARE: Empowering the Community to Evaluate Agents 
https://huggingface.co/blog/gaia2

 

Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments (2026-02-12)
https://arxiv.org/abs/2602.11964

 

Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments
https://openreview.net/forum?id=9gw03JpKK4

 

Meta AI Researcher Explains ARE and Gaia2: Scaling Up Agent Environments and Evaluations
https://arize.com/blog/meta-ai-researcher-explains-are-and-gaia2/
https://www.youtube.com/watch?v=lT4qtOlvhak


MCP Security

OWASP MCP Top 10
https://owasp.org/www-project-mcp-top-10/

 

The State of MCP Security, Pynt's 2025 Report
https://www.pynt.io/blog/llm-security-blogs/state-of-mcp-security
"Pynt’s latest research analyzes 281 MCP configurations collected from open agent frameworks and plugin stacks." 

 

MCP Horror Stories: The Security Issues Threatening AI Infrastructure
https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/

 

GitHub MCP Exploited: Accessing private repositories via MCP
https://invariantlabs.ai/blog/mcp-github-vulnerability

 

Securing the Model Context Protocol (MCP) Server
https://kenhuangus.substack.com/p/securing-the-model-context-protocol

 

A Security Engineer's Guide to MCP
https://semgrep.dev/blog/2025/a-security-engineers-guide-to-mcp/

 

Anthropic won't own MCP 'design flaw' putting 200K servers at risk, researchers say
https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/

 

The Mother of All AI Supply Chains: Critical, Systemic Vulnerability at the Core of Anthropic’s MCP
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/
"Anthropic design choice Exposes 150M+ Downloads and up to 200K Servers to complete takeover"


The Mother of All AI Supply Chains: Technical Deep Dive
https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-technical-deep-dive/

 

 

 

 

 

Posted by No comments:

2026-08-29

2026-08-29 Saturday - The Last 365 Days - some of my LinkedIn engagement stats

[image credit: LubosHouska  on pixabay dot com]

I consider the act of writing to be a craft, and the image of the wheel of the potter resonates well with my intention to create. 

My first audience is myself. I write to clarify my thinking, to capture contemporaneous events & ideas, and to document what I have discovered and learned – at a point in time.

A secondary goal is to help others: To illuminate, teach, educate, elevate, inform, advise, and provide insights. 

My writing is published through three primary channels: This blog, my LinkedIn posts, and my collection of GitHub repositories. 

With respect to LinkedIn, I took a moment today to reflect on some of my LinkedIn engagement stats.  

Note: 

  • My current LinkedIn Connections count: 6,830 
  • I am *very* selective about who I connect with on LinkedIn. 
  • I decline more connection requests than I accept. 
  • Given a choice between gaining 60K more followers/connections, or just two high quality connections that create, make, contribute, share, and actively post/write – without hesitation, I will choose just the two. 

Discovery: 

2026-08-29 Sat - Last 365 Days, SNAPSHOT

 

Engagement:   

2026-08-29 Sat - Last 365 Days, SNAPSHOT


Demographics: 

2026-08-29 Sat - Last 365 Days, SNAPSHOT

Posted by No comments:

WordCount

Copyright

© 2001-2026 International Technology Ventures, Inc., All Rights Reserved.